MiniScope：通过两阶段迭代混合分析实现小程序的自动化UI探索与隐私不一致性检测
MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis
AI总结：
针对小程序隐私风险缺乏有效检测机制的问题，提出两阶段混合分析工具MiniScope，结合UI探索与跨包分析等技术，在12万余个小程序中发现大量隐私不一致问题，并推动开发者整改。
摘要：
小程序运行于大型超级应用（SuperApp）之内，无需单独下载应用即可提供丰富服务，革新了用户体验。但这种便利性也引发了严重的隐私问题：这些小程序往往需要访问敏感数据，可能导致隐私侵犯。尽管已有隐私法规与平台指南，仍缺乏充分保障用户隐私的有效机制。为填补这一关键空白，我们提出MiniScope——一种专为小程序环境设计的新型两阶段混合分析方法。该方法结合UI状态转移分析、跨包回调控制流解析与自动化迭代UI探索，克服了现有静态分析技术的局限，能够全面理解小程序的隐私实践，解决了分包加载与事件驱动回调带来的独特挑战。我们使用MiniScope对超过12万个小程序开展实证评估，验证了其识别隐私不一致问题的有效性。结果显示问题十分突出：5.7%的小程序过度收集隐私数据，33.4%的小程序过度声明数据收集权限。我们已负责任地向2282名开发者披露了研究发现，收到44份确认回复。这些发现凸显了建立更精准隐私监控系统的迫切需求，也强调了超级应用运营方推行更严格隐私措施的责任。
英文摘要：
The advent of MiniApps, operating within larger SuperApps, has revolutionized user experiences by offering a wide range of services without the need for individual app downloads. However, this convenience has raised significant privacy concerns, as these MiniApps often require access to sensitive data, potentially leading to privacy violations. Despite existing privacy regulations and platform guidelines, there is a lack of effective mechanisms to safeguard user privacy fully. To address this critical gap, we introduce MiniScope, a novel two-phase hybrid analysis approach, specifically designed for the MiniApp environment. This approach overcomes the limitations of existing static analysis techniques by incorporating UI transition states analysis, cross-package callback control flow resolution, and automated iterative UI exploration. This allows for a comprehensive understanding of MiniApps' privacy practices, addressing the unique challenges of sub-package loading and event-driven callbacks. Our empirical evaluation of over 120K MiniApps using MiniScope demonstrates its effectiveness in identifying privacy inconsistencies. The results reveal significant issues, with 5.7% of MiniApps over-collecting private data and 33.4% overclaiming data collection. We have responsibly disclosed our findings to 2,282 developers, receiving 44 acknowledgments. These findings emphasize the urgent need for more precise privacy monitoring systems and highlight the responsibility of SuperApp operators to enforce stricter privacy measures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
